How Spanwhale Commerce Hub handles and protects information.

1. Who we are

Guangzhou Youyan Technology Co., Ltd. provides Spanwhale Commerce Hub, a marketplace operations solution for independent selling partners and their authorized users. The solution supports product, listing, inventory, order-status, pricing, reporting, and separately authorized advertising workflows.

2. Information we collect and process

We may process business contact details, support communications, account administrator and authorized-user details, system activity, and technical information needed to operate and secure the service.

After a selling partner authorizes the application, Amazon seller information may include seller and marketplace identifiers, product catalog data, listings, SKUs, item identifiers, inventory levels, offer pricing, order status, shipment status, sales metrics, operational reports, and account performance summaries. Where separately authorized, advertising data may include advertiser profiles, campaigns, ad groups, keywords, bids, budgets, targeting, and performance reports.

Our planned initial SP-API role scope does not require restricted buyer personally identifiable information such as buyer names, shipping addresses, buyer communications, or payment information. We do not use Amazon information for consumer profiling or advertising unrelated to the authorizing seller's business.

3. How we use information

We use information to provide and support the solution, authenticate users, connect authorized seller accounts, display and update enabled marketplace workflows, prepare operational reports, review performance, maintain account security, troubleshoot issues, respond to support requests, and comply with applicable legal and contractual obligations. Amazon information is processed only for the selling partner that authorized access.

4. Authorization and seller control

Public seller authorization is handled through Login with Amazon OAuth and the applicable Amazon authorization workflow. We do not collect, request, or store Seller Central or Amazon account passwords. Each selling partner reviews the requested permissions and grants access directly through Amazon. A seller may revoke authorization through Amazon's Manage Your Apps page or request account disconnection from us.

5. Account separation and access control

Each selling partner receives a logically separated workspace. Seller identifiers, access and refresh tokens, application records, users, permissions, and operational data are separated by seller account. We use token separation by seller account, least privilege access, role-based access control, and periodic access reviews. Personnel access is limited to authorized individuals with a documented business need.

6. Security safeguards

Amazon information and credentials are protected using encryption in transit and at rest. Credentials are maintained through secure credential storage and are not hard-coded in source code or exposed in public repositories. Audit logs record security-relevant system and administrative activity. We maintain separate development and production controls and apply vulnerability management, credential rotation, incident response, backup, and secure software development procedures appropriate to the service.

7. Data sharing and service providers

We do not sell, rent, or share Amazon seller data, advertising data, or personal information with external third parties for their own marketing or independent use. We may engage vetted infrastructure, hosting, security, or support processors only where necessary to operate the service. Such processors receive only the minimum information needed, act under confidentiality and data-protection obligations, and may not use the information for their own purposes. We may disclose information when required by law or to protect the security and legal rights of users, the company, or others.

8. Data retention and deletion policy

We retain Amazon information only while it is needed to provide enabled features, meet a documented business purpose, or satisfy legal and security obligations. Non-PII Amazon information is retained for no longer than 18 months unless a shorter period applies or longer retention is legally required. Security logs are retained for at least 12 months. Authorization credentials are deleted or rendered unusable after disconnection or revocation when no longer required for permitted operational or legal purposes.

When information reaches the end of its retention period, it is securely deleted or de-identified. We process valid Amazon deletion notices within 30 days unless retention is required by applicable law, tax, or regulatory obligations.

9. Deletion requests and account closure

Selling partners may request access to or deletion of their account-related information by contacting us. After we verify the request, we disconnect the relevant account and securely delete or de-identify retained information according to this policy, subject to applicable legal obligations. Revoking Amazon authorization stops new Amazon information from being collected but does not replace a deletion request for information already retained.

10. Policy changes

We may update this policy to reflect changes in the solution, legal requirements, or data protection practices. The current version and effective date will remain available on this page. Material changes will be communicated through an appropriate service or support channel where required.

11. Contact

For privacy questions, data requests, or security concerns, contact Guangzhou Youyan Technology Co., Ltd. at havecolor@163.com.

Last updated: August 15, 2026